41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 20:21

Target

D3E0800E550889AD45270980CA5D31D2.exe
Size

65KB
MD5

d3e0800e550889ad45270980ca5d31d2
SHA1

3cc43700ce7b812c3c90d74b1fb7757cc14dd026
SHA256

41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
SHA512

bf4b5ae13f5ae0371d87c33245e54271f45b93a213adc9cc7328d10df1f249efb165718d4949b1320e9223a3d8d313460d9386599ede0366842b527c03a3be1c
SSDEEP

768:Y/qvB/iUdgf7x44gpjoc3+0gJou/WDkdR0ybsazEPMV8PMeNkyAqFnviseo:hJqpXSotK5aeN5Jxviseo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	1708	WerFault.exe	23

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	D3E0800E550889AD45270980CA5D31D2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3064	1708	D3E0800E550889AD45270980CA5D31D2.exe	28
PID 1708 wrote to memory of 3064	1708	D3E0800E550889AD45270980CA5D31D2.exe	28
PID 1708 wrote to memory of 3064	1708	D3E0800E550889AD45270980CA5D31D2.exe	28
PID 1708 wrote to memory of 3064	1708	D3E0800E550889AD45270980CA5D31D2.exe	28

C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe
"C:\Users\Admin\AppData\Local\Temp\D3E0800E550889AD45270980CA5D31D2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1084
  2⤵
  - Program crash
  PID:3064

memory/1708-0-0x0000000001090000-0x00000000010A6000-memory.dmp

Filesize
88KB

Download
memory/1708-1-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-2-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/1708-3-0x0000000074380000-0x0000000074A6E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-4-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download